"""Verify original request bytes before decoding JSON. Keep the secret server-side."""
import base64
import hashlib
import hmac
import re
import time


def verify_webhook(raw_body: bytes, headers: dict[str, str], secret: str, now_seconds: int | None = None) -> str:
    values = {key.lower(): value for key, value in headers.items()}
    event_id = values.get("webhook-id", "")
    timestamp = values.get("webhook-timestamp", "")
    signatures = values.get("webhook-signature", "")
    now = int(time.time()) if now_seconds is None else now_seconds
    if (not re.fullmatch(r"[A-Za-z0-9_-]{1,100}", event_id)
            or not re.fullmatch(r"[0-9]{1,12}", timestamp)
            or abs(now - int(timestamp)) > 300
            or not re.fullmatch(r"whsec_[A-Za-z0-9+/]{43}=", secret)):
        raise ValueError("Invalid webhook")
    signed = f"{event_id}.{timestamp}.".encode() + raw_body
    expected = hmac.new(base64.b64decode(secret[6:], validate=True), signed, hashlib.sha256).digest()
    for signature in signatures.split(" "):
        version, separator, encoded = signature.partition(",")
        if version == "v1" and separator and re.fullmatch(r"[A-Za-z0-9+/]{43}=", encoded):
            if hmac.compare_digest(expected, base64.b64decode(encoded, validate=True)):
                return event_id
    raise ValueError("Invalid webhook")